Extracted

• • Target

    Odeme -(Mayis).exe

  • Size

    243KB

  • MD5

    675943378edf65821651532354a211f7

  • SHA1

    bb3ad849880cc1ca9f946e7c3d56b605132cab68

  • SHA256

    b23e432607f98a398b19419f30eca5bdbca21b662ce18b882830bfef370a9a46

  • SHA512

    6d6ea3b7503d4be8b14217cb1f919404eb5cdfd2d546535c14ed75835293bfd9c2a6564b54cb8ea4487b7d49a4db75d1aafc5f022ea01c58c96d60d8b2ee0bc9

  • SSDEEP

    6144:1surFANhoBJbRZlFOKC1XozQ9I1Qcti4a/ME46/QqBwdhHGPxMNI:KurFANSLdpOb14zQ9wI/Mf6tBwdhHGPZ

  Score

  10^/10

  xenoratrattrojan

  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2